If the user's email is compromised, the Dropbox confirmation email would be easy to locate and harvest, either from their mailbox, or their mail hosting provider's delivery logs.
(Usually, however, malware simply scans for all incoming email addresses, and then reports them to a central authority for later spamming.)
EDIT: As pointed out elsewhere in this thread, the email address <dropbox@yourdomain> is trivially guessable by dictionary spam attacks.
There are many routes to this information leaking. It is not at all apparent whether it's Dropbox yet.
Given that Dropbox security is actively responding in the linked forum, it seems as though this HN post - submitted by one of the users posting in that thread as "affected" - is solely to create "buzz", rather than to share news with Hacker News.
* Multiple users with email addresses unique to their Dropbox account are reporting spam. It's unlikely these individuals' computers or email accounts were all compromised at the same time.
* These same users aren't reporting spam on their other unique addresses or catchall accounts. Some of them are non-trivial addresses that would be hard to guess. It's unlikely to be a bot guessing email addresses.
Maybe I'm missing something here, but where else could a non-guessable e-mail address which was never used anywhere else been leaked from if not Dropbox itself?
EDIT: Apps. Any app you've ever authorized to use your Dropbox account could have leaked the email address - for instance, via plaintext logs, or malicious behavior, or well-intended but stupid behavior - by writing the email address in plaintext to disk, or uploading it to a remote server and then losing control of it there.
Whats even worse: The first reports came in (from users!) over one day ago and the forum thread seems to indicate that they still have no clue what happend!
[Update] One possibility might be, that dropbox is not the culprit after all but that the spammers started to realize that people use those service-specific addresses more and more and they just send out emails to [some-service-name]@[some-domain]. At least my address is dropbox@[mydomain].
So lets hope for that...
Given their previous problems, you would think they would be on top of this immediately.
"Hi all,
We are actively investigating your reports. If you have any additional information, please email security@dropbox.com, and we’ll be sure to follow up
Joe"
The only messages that have ever been sent to that specific address are from Dropbox themselves...
The email-address i signed up with and the one that is attached to my account is @gmail.com
However, i've recently invited 2 people with my personal @gmx.de email (using the iPhone app) and guess what...
I've got Euro Dice spam in my spamfolder there :(
Malware frequently targets address books and browser forms as a means of harvesting email addresses. Not saying that it can't be Dropbox, and I'm not saying that it's even unlikely, but years of troubleshooting have taught me not to name the root cause until I can verify it myself. This is even more true when you're putting someone else's reputation on the line.
The address book scenario or dropbox breach both seem more likely, but it's worth keeping in mind.
// I did change the title to not mislead readers.
The Internet would be a better place if people would stop, take a deep breath and think before they type.
Good idea: Let the dropbox folks know that you received spam to a custom address tied to their service and let them look into it, whether it be a directed spam campaign or a possible leak.
Bad idea: "OMG!!1! Dropbox is pwn3d! Admit it! Apologize for your wrongs!"
If you use your DropBox referal code, on this page:
https://www.dropbox.com/account/bonus
You will see a list of peoples email addresses that clicked the link and signed up. Unbeknownst to them you have their email addresses.
We have hundreds of these email addresses in our account as we have been promoting DropBox on our website for a long time. The referral status page also shows information about how far through the install they are, when they signed up etc.
This is bad because it makes phishing quite easy.
Perhaps not the source of the spam, but nonetheless still a bad execution in my opinion.
